Read the docs
TI-2026-05194 Aliases CVE-2026-5917GHSA-3gwr-xcwq-7892

libgit2 Shell Command Injection via ssh_libssh2 Backend

Priority MEDIUM 42CWE-78Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
Active
Attack complexity
Low
Attack requirements
None
Impact type
Code execution
Confidentiality · integrity · availability
High · High · High
Fix status
Partial Red Hat: 1 without a fix

Attack profile from CVSS 4.0 · CNA. Fix status from CNA and Red Hat. Impact type from CWE-78.

Summary

libgit2 versions before 1.8.7 and 1.9.0 before 1.9.7 built with the libssh2 SSH backend (USE_SSH=libssh2) contain a shell command injection vulnerability that allows remote attackers to execute arbitrary commands on an SSH server by supplying a repository path containing unescaped shell metacharacters such as single quotes, semicolons, or pipes. The gen_proto() function in ssh_libssh2.c inserts the repository path directly into a shell command string without escaping special characters before passing it to libssh2_channel_exec(), enabling an attacker to craft a malicious submodule URL in a .gitmodules file that, when processed during a recursive clone, causes the remote server's shell to interpret injected commands under the victim's SSH user account.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.01427 73rd percentileScored 2026-11-07
Fix Partial libgit2 (libgit2): 1.8.7, 1.9.7Red Hat: 1 without a fix

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
No
Technical impact
Total

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
libgit2libgit2before 1.8.7; 1.9.0 to before 1.9.71.8.7, 1.9.7Patch availableCNA
  • libgit2 Vendorlibgit2 Affected before 1.8.7; 1.9.0 to before 1.9.7 Fixed in 1.8.7, 1.9.7 Patch available CNA

CPE names Threatist (inferred) · 1

Inferred from how NVD named this product before; not given by a source.

CPEVersionsRoleVendor
cpe:2.3:a:libgit2:libgit2:*:*:*:*:*:*:*:*——libgit2
  • cpe:2.3:a:libgit2:libgit2:*:*:*:*:*:*:*:* Versions — — ·libgit2

Remediation

  • Fix · CNA libgit2 (libgit2) Fixed in 1.8.7, 1.9.7

Vendor assessments

Red Hat

Red Hat rating: Important. Red Hat's page for this CVE →

ProductStatusPlan or fix
Red Hat Enterprise Linux AI (RHEL AI) 3AffectedNo fix yet
Not affected: 5 products
  • Red Hat Enterprise Linux 10
  • Red Hat Enterprise Linux 8
  • Red Hat Enterprise Linux 9
  • Red Hat Enterprise Linux AI (RHEL AI) 3
  • Red Hat Hardened Images

Timeline

  1. 2026-10-02 Threatist record created from CVE-2026-5917
  2. 2026-10-03 Alias added: GHSA-3gwr-xcwq-7892

References

Patch 1

  • TI-2014-07619 Git before 1.8.5.6, 1.9.x before 1.9.5, 2.0.x before 2.0.5, 2.1.x before 2.1.4, and 2.2.x… CVSS 3.1CRITICAL 9.8
  • TI-2026-38647 libgit2 - Unauthenticated network-reachable heap out-of-bounds read in transports/smart_pkt.c:set_data CVSS 3.1HIGH 7.5
  • TI-2026-38643 libgit2: Inverted IP SubjectAltName Comparison in OpenSSL Backend CVSS 3.1MEDIUM 6.5
  • TI-2026-38645 libgit2: Unbounded Memory Allocation via Delta Object Result-Size Header CVSS 3.1MEDIUM 5.3
  • TI-2024-16198 libgit2 is vulnerable to arbitrary code execution due to heap corruption in `git_index_add` CVSS 3.1CRITICAL 9.8
  • TI-2020-09811 An issue was discovered in libgit2 before 0.28.4 and 0.9x before 0.99.0. CVSS 3.1CRITICAL 9.8
See all 16 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences